Oracle ships emergency Java fix for CVSS 9.1 JSSE trust flaw

2 sources · 2 articlesFirst reported Oct 23, 2026 · 06:01 UTCUpdated Oct 23, 2026 · 06:11 UTC (2d ago)

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Oracle’s October 21 update for CVE-2026-91403 distrusts weak eMudhra intermediates; exploitation is not confirmed.

Oracle issued an emergency update on October 21, 2026, for CVE-2026-91403, a CVSS 9.1 flaw in JSSE certificate trust in Oracle Java SE and GraalVM. The update distrusts affected eMudhra intermediate certificates rather than disabling HTTPS. Cyber Security News, citing Red Hat, says weak private keys could let an on-path attacker forge trusted hostnames; GBHackers describes an unauthenticated remote impact on confidentiality and integrity, not availability, and says the advisory does not describe code execution. Oracle does not report confirmed exploitation. Customers can install listed updates, block the certificates, or enable revocation checking, including October 22 guidance on TLS and jarsigner checks.

Key facts

CVE-2026-91403 is rated CVSS 9.1; Oracle cites low complexity and no user interaction.
Affected Java SE builds include 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1.
GraalVM JDK 17.0.21 and 21.0.13 and Enterprise Edition 21.3.20 are included.
Java 8 blocking uses blacklisted.certs; later releases use blocked.certs.
Earlier unsupported releases may be vulnerable; Oracle did not test them.
No confirmed attacks; the advisory does not describe an exploit chain.

Analyze CVE-2026-91403 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Oct 21, 2026Oracle publishes emergency Java and GraalVM update · Cyber Security News
Oct 22, 2026Guidance covers TLS revocation checking and jarsigner revcheck · GBHackers

What each outlet adds

beyond the shared facts

Cyber Security NewsCites Red Hat on weak eMudhra keys and on-path hostname forgery.
GBHackersNotes no code execution and October 22 jarsigner revocation guidance.

CVEs: CVE-2026-91403

Vendors: Oracle
Products: Java SE GraalVM Oracle Java SE Oracle GraalVM Oracle GraalVM Enterprise Edition
Organizations: eMudhra Red Hat

Coverage

oldest first · one row per article · UTC

Oct 23, 06:01 UTC · 2d ago Cyber Security NewsFirst report
Oracle emergency Java update distrusts weak eMudhra CAs (CVE-2026-91403)
The CVSS 9.1 JSSE flaw can let an on-path attacker forge trusted hostnames; no attacks are confirmed.
Oct 23, 06:11 UTC · 2d ago GBHackers
Oracle Java flaw CVE-2026-91403 allows unauthenticated remote attacks
The CVSS 9.1 JSSE issue concerns trust in compromised eMudhra intermediate certificates, not confirmed code execution.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-91403	JSSE trust flaw in Oracle Java SE and GraalVM	9.1	—		3d ago